Creation of clean and poisoned training datasets:
The training images for each class in TrojAI challenge (Rounds 1-4) are created according to Figure REF  by fusing and post-processing foreground and background images. Images of foreground traffic signs are constructed from images of real and simulated traffic signs. The background images are retrieved from existing road and city video sequences (e.g., citiscapes [1]}, KITTI 360 by Karlsruhe Institute of Technology and Toyota Technological Institute at Chicago [2]}, and others [3]}). A variety of images per traffic sign class is accomplished by changing parameters of crop, transformation, fusion, and post-processing operations as shown in Figure REF .
<FIGURE>